arXiv Science⌕ Search
Home/Archive/arXiv

arXiv · 2610.02805

From TS-SUF-2 to TS-SUF-4: Practical Security Enhancements for FROST2 Threshold Signatures

Will Wang·Syh-Yuan Tan·Ryan Chow·Chanson Chan·Martin Zhao
View original source ↗Read source document ↗Export metadata ↓

Abstract

Threshold signature schemes play a vital role in securing digital assets within blockchain and distributed systems. FROST2 stands out as a practical threshold Schnorr signature scheme, noted for its efficiency and compatibility with standard verification processes. However, under the one-more discrete logarithm assumption, with static corruption and centralized key generation settings, FROST2 has been shown by Bellare et al. (in CRYPTO 2022) to achieve only TS-SUF-2 security, which is a consequence of its vulnerability to TS-UF-3 attacks. In this paper, we address this security limitation by presenting an enhanced variant of FROST2, namely, FROST2+ which achieves the TS-SUF-4 security level under the same computational assumptions as the original FROST2. FROST2+ strengthens FROST2 by integrating additional pre-processing token verifications that help mitigate TS-UF-3 and TS-UF-4 vulnerabilities while maintaining practical efficiency. We show that FROST2+ can achieve TS-SUF-4 security not only under the same conditions as the original FROST2 analysis, but also when initialized with a distributed key generation protocol such as PedPoP. Our benchmark using ZCash's FROST library shows that the performance of FROST2+ is comparable to FROST2 and about 64-79% faster than FROST when precomputation is enabled.

Explore related subjects

cs.CR

Keep this discovery

Explore connections, maps & timelines

BibTeXRIS

Will Wang, Syh-Yuan Tan, Ryan Chow, Chanson Chan, Martin Zhao. 2026-10-02. From TS-SUF-2 to TS-SUF-4: Practical Security Enhancements for FROST2 Threshold Signatures. https://arxiv.org/abs/2610.02805

Cite the original work for its findings. Save a collection to share your selection of sources.

KEEP EXPLORING

Related papers

arXiv2026

Extended Differential Cryptanalysis of Kuznyechik

We study the input-side relation $F(cx\oplus a)\oplus F(x)=b$ as an extended differential for block-cipher analysis. Because multiplication occurs before the first S-box, fixing that S-box output leaves an ordinary XOR difference for subsequent binary linear layers and common key additions. For permutations, the extended and outer $c$-differential tables are related by inversion. For the Kuznyechik S-box, the exceptional inverse classes $\mathtt{02}/\mathtt{e1}$, $\mathtt{04}/\mathtt{91}$, and $\mathtt{03}/\mathtt{be}$ have exact extended differential uniformities $64$, $33$, and $21$. We connect them to the pseudo-exponential structure of Perrin and Udovenko through a cross-field transfer theorem. In the common polynomial basis, the disagreement rank between multiplication maps in the hidden and Kuznyechik fields equals the degree of the multiplier polynomial, yielding structural lower bounds $60$, $30$, and $16$. We also analyze the complete extended differential table: its normalization is doubly stochastic, its energy is an exact multiplicative correlation of ordinary DDT rows, and transferred hidden fibers give explicit Pearson and Shannon-information bounds. Whitening selects the effective row $a\oplus(1\oplus c)K$. For two-round standard Kuznyechik we derive the exact fixed-key channel $Q_{c,\ell}=W_cP_\ell W_1$ and a two-stage maximum-likelihood attack. With $c=\mathtt{04}$ it recovers the full $256$-bit master key with failure probability at most $0.01$, using $226{,}512$ chosen-plaintext pairs and at most $240{,}669$ encryption queries. Restricted product-model searches give gains of $5.2$, $4.6$, and about $1.6$ bits over the corresponding classical families at two, three, and four rounds. A separate nine-round no-pre-whitening Monte Carlo study is reported only as exploratory evidence because its final configurations followed preliminary screening.

cs.CR↗
arXiv2026

Mitigating Watermark Forgery in Generative Models via Randomized Key Selection

Watermarking enables GenAI providers to verify whether content was generated by their models. A watermark is a hidden signal in the content, whose presence can be detected using a secret watermark key. A core security threat are forgery attacks, where adversaries insert the provider's watermark into content \emph{not} produced by the provider, potentially damaging their reputation and undermining trust. Existing defenses resist forgery by embedding many watermarks with multiple keys into the same content, which can degrade model utility. However, forgery remains a threat when attackers can collect sufficiently many watermarked samples. We propose a defense with a sample-count-independent upper bound on forgery success for blind attackers, conditional on key-symmetric, independent detector outcomes. Our scheme does not further degrade model utility. We randomize the watermark key selection for each query and accept content as genuine only if a watermark is detected by \emph{exactly} one key. Unlike cryptographic watermarks that rely on computational hardness assumptions and require designing new watermarking schemes from scratch, our method can be applied to any existing watermarking method to improve its forgery resistance. We focus on text watermarking, but our defense is modality-agnostic, since it treats the underlying watermarking method as a black-box. To show this, we include a preliminary study on image watermarking using Tree-Ring. Separately from this conditional guarantee, we empirically observe that, at $r=4$ keys, harmful-text forgery success drops from as high as $87\%$ with a single key to as low as $1\%$ against the adaptive blind attackers that we evaluate, at negligible computational overhead; a preliminary image study shows a reduction from $100\%$ to $2\%$.

cs.CR↗
arXiv2026

Understanding Gaps in LLM Pipelines Towards Scalable Fuzzing Harness Generation: An Empirical Study and Enhancement

Large language model (LLM)-based techniques have achieved notable progress in fuzz harness generation. However, applying them to arbitrary functions \textit{at scale} remains difficult---generated harnesses often fail to compile or, worse, compile but remain logically ineffective. What factors drive success and what limitations hinder current methods remain unclear. To answer these questions, we conduct an empirical study on state-of-the-art LLM-based harness generation frameworks across 29 OSS-Fuzz projects. Our study establishes two pillars of success: contextual information to guide generation and pre-structured pipelines that ensure workflow stability. However, significant gaps remain: (1) existing context retrieval methods lack the robustness to reliably obtain necessary information across diverse projects; (2) current validation mechanisms fail to detect logically ineffective harnesses, such as those containing fabricated definitions; and (3) compilation workflows are brittle, unable to distinguish harness-level errors from build-configuration issues. We demonstrate the utility of these findings by enhancing existing techniques with a hybrid tool pool for robust context retrieval, an enhanced validation pipeline, and a compilation-error triage strategy. Evaluated on 243 OSS-Fuzz projects (65 C and 178 C++), the enhanced approach improves the three-shot success rate by approximately 20\% over state-of-the-art techniques, reaching 87\% for C and 81\% for C++. Our one-hour fuzzing results show that more than 75\% of the generated harnesses increase target-function coverage, surpassing baselines by over 10\%. In addition, the enhanced approach identified 15 new vulnerabilities across 11 real-world projects.

cs.CR↗